|
|
#include "pch.h"
#include <authzi.h>
PSID pSid = NULL;
void _cdecl wmain(int argc, WCHAR * argv[]){ LONG i = 0; LONG ii = 0; LONG j = 0; LONG Iterations = 0; BOOL b = TRUE; AUTHZ_AUDIT_EVENT_HANDLE hAAI1 = NULL; AUTHZ_AUDIT_EVENT_HANDLE hAAI2 = NULL; AUTHZ_AUDIT_EVENT_HANDLE hOA = NULL; AUTHZ_RESOURCE_MANAGER_HANDLE hRM = NULL; AUTHZ_AUDIT_QUEUE_HANDLE hAAQ = NULL; AUTHZ_CLIENT_CONTEXT_HANDLE hCC = NULL; PSECURITY_DESCRIPTOR pSD = NULL; PSECURITY_DESCRIPTOR pSD2 = NULL; PSECURITY_DESCRIPTOR pASD[2]; PWCHAR StringSD = L"O:BAG:BUD:(A;;0x40;;;s-1-2-2)(A;;0x1;;;BA)(OA;;0x2;6da8a4ff-0e52-11d0-a286-00aa00304900;;BA)(OA;;0x4;6da8a4ff-0e52-11d0-a286-00aa00304901;;BA)(OA;;0x8;6da8a4ff-0e52-11d0-a286-00aa00304903;;AU)(OA;;0x10;6da8a4ff-0e52-11d0-a286-00aa00304904;;BU)(OA;;0x20;6da8a4ff-0e52-11d0-a286-00aa00304905;;AU)(A;;0x40;;;PS)S:(AU;IDSAFA;0xFFFFFF;;;WD)"; HANDLE hToken = NULL; UCHAR Buffer[256]; AUTHZ_ACCESS_REQUEST Request = {0}; PAUTHZ_ACCESS_REPLY pReply = (PAUTHZ_ACCESS_REPLY) Buffer; LUID Luid = {0xdead,0xbeef}; PAUDIT_PARAMS pParams = NULL; AUTHZ_AUDIT_EVENT_TYPE_HANDLE pAEI = NULL; AUTHZ_ACCESS_CHECK_RESULTS_HANDLE hCache = NULL; if (argc != 2) { wprintf(L"usage: %s iterations\n", argv[0]); exit(0); }
Iterations = wcstol(argv[1], NULL, 10);
wprintf(L"Log Stress with queues. Default and specific queue each with %d audits. Press a key to start.\n", Iterations); getchar();
if (!b) { wprintf(L"SDDL failed with %d\n", GetLastError()); return; }
b = AuthzInitializeResourceManager( 0, NULL, NULL, NULL, L"Jeff's RM", &hRM );
if (!b) { wprintf(L"AuthzInitializeResourceManager failed with %d\n", GetLastError()); return; }
//
// Create a client context from the current token.
//
OpenProcessToken( GetCurrentProcess(), TOKEN_QUERY, &hToken );
b = AuthzInitializeContextFromToken( 0, hToken, hRM, NULL, Luid, NULL, &hCC );
if (!b) { wprintf(L"AuthzInitializeContextFromToken failed with 0x%x\n", GetLastError()); return; }
for (i = 0; i < Iterations; i++) {
//
// Create the SD for the access checks
//
b = ConvertStringSecurityDescriptorToSecurityDescriptorW( StringSD, SDDL_REVISION_1, &pSD, NULL );
pASD[0] = pSD; pASD[1] = pSD;
AuthzInitializeObjectAccessAuditEvent( 0, NULL, L"op", L"object type", L"object name", L"info", &hOA, 0 ); if (!b) { wprintf(L"AuthzInitializeObjectAccessAuditEvent failed with %d\n", GetLastError()); return; }
b = AuthziInitializeAuditEvent( AUTHZ_NO_ALLOC_STRINGS | AUTHZ_DS_CATEGORY_FLAG, hRM, NULL, NULL, NULL, INFINITE, L"This is with the default RM queue.", L"This is with the default RM queue.", L"This is with the default RM queue.", L"This is with the default RM queue.", &hAAI1 );
if (!b) { wprintf(L"AuthzInitializeAuditInfo (no queue) failed with %d\n", GetLastError()); return; }
b = AuthziInitializeAuditQueue( AUTHZ_MONITOR_AUDIT_QUEUE_SIZE, 1000, 100, NULL, &hAAQ );
if (!b) { wprintf(L"AuthziInitializeAuditQueue failed with %d\n", GetLastError()); return; }
b = AuthziAllocateAuditParams( &pParams, 1 );
if (!b) { wprintf(L"AuthzAllocateAuditParams failed with %d\n", GetLastError()); }
b = AuthziInitializeAuditParams( 0, pParams, &pSid, L"foo", 1, APT_String, L"This audit was with a custom AUDIT_EVENT_INFO, AUDIT_PARAMS, and queue." );
// b = AuthziInitializeAuditParamsWithRM(
// 0,
// hRM,
// 1,
// pParams,
// APT_String, L"This audit was with a custom AUDIT_EVENT_INFO, AUDIT_PARAMS, and queue."
// );
if (!b) { wprintf(L"AuthzInitializeAuditParamsWithRM failed with %d\n", GetLastError()); }
b = AuthziInitializeAuditEventType( 0, SE_CATEGID_OBJECT_ACCESS, 567, 1, &pAEI );
if (!b) { wprintf(L"AuthzInitializeAuditEvent failed with %d\n", GetLastError()); }
b = AuthziInitializeAuditEvent( AUTHZ_NO_RM_AUDIT, NULL, //hRM,
pAEI, pParams, NULL, INFINITE, L"This is with a specific queue and params.", L"This is with a specific queue and params.", L"This is with a specific queue and params.", L"This is with a specific queue and params.", &hAAI2 );
if (!b) { wprintf(L"AuthziInitializeAuditEvent (with queue) failed with %d\n", GetLastError()); return; }
for (ii = 0; ii < 100; ii++) { b = AuthziLogAuditEvent( 0, hAAI2, NULL ); if (!b) { wprintf(L"log failed with %d \n", GetLastError()); return; }
} Request.ObjectTypeList = NULL; Request.PrincipalSelfSid = NULL; Request.DesiredAccess = MAXIMUM_ALLOWED;
pReply->ResultListLength = 1; pReply->Error = (PDWORD) (((PCHAR) pReply) + sizeof(AUTHZ_ACCESS_REPLY)); pReply->GrantedAccessMask = (PACCESS_MASK) (pReply->Error + pReply->ResultListLength); pReply->SaclEvaluationResults = (PDWORD) pReply->GrantedAccessMask + (sizeof(ACCESS_MASK) * pReply->ResultListLength);
b = AuthzAccessCheck( 0, hCC, &Request, hOA, pSD, pASD, 2, pReply, &hCache );
if (!b) { wprintf(L"AuthzAccessCheck (with queue) failed with %d\n", GetLastError()); return; }
pSD2 = pSD; pSD = NULL;
for (j = 0; j < 100; j++) {
b = AuthzCachedAccessCheck( 0, hCache, &Request, hOA, pReply ); b = AuthzCachedAccessCheck( 0, hCache, &Request, hAAI1, pReply ); b = AuthzCachedAccessCheck( 0, hCache, &Request, hAAI1, pReply );
if (!b) { wprintf(L"CachedAuthzAccessCheck (no queue) failed with %d\n", GetLastError()); return; } } b = AuthzFreeAuditEvent( hAAI2 );
b = AuthzFreeAuditEvent( hAAI1 ); b = AuthzFreeAuditEvent( hOA );
if (!b) { wprintf(L"AuthzFreeAuditInfo (no queue) failed with %d\n", GetLastError()); return; }
b = AuthziFreeAuditEventType( pAEI );
if (!b) { wprintf(L"AuthzFreeAuditEventType failed with %d\n", GetLastError()); return; }
b = AuthziFreeAuditParams( pParams );
if (!b) { wprintf(L"AuthzFreeAuditParams failed with %d\n", GetLastError()); return; }
b = AuthziFreeAuditQueue( hAAQ );
if (!b) { wprintf(L"AuthzFreeAuditQueue failed with %d\n", GetLastError()); return; }
b = AuthzFreeHandle( hCache );
if (!b) { wprintf(L"AuthzFreeHandle failed with %d\n", GetLastError()); return; } } b = AuthzFreeContext( hCC );
if (!b) { wprintf(L"AuthzFreeContext failed with %d\n", GetLastError()); return; }
b = AuthzFreeResourceManager( hRM );
if (!b) { wprintf(L"AuthzFreeResourceManager failed with %d\n", GetLastError()); return; }
wprintf(L"Done. Press a key.\n"); getchar();}
|
